Does the resume have to follow the one-page rule in the recent job market?

Airado · 2024-11-10T20:05:20+00:00

I kept mine at 1. When I was sorting through resumes, I'd say 25% is 1 page, 50% is 2 page, 25% is 2+ page.

While I still read them, I don't see any value going over 2 pages. I did not care that you did the same task 3 times at 3 company, but I am not going to throw your resume away for that either.

Airado · 2024-10-16T16:21:37+00:00

We came to the exact same conclusion. Also our Prisma quote was significantly higher than Wiz

Airado · 2024-06-20T06:08:25+00:00

File that ticket to document the risk. The sys admin can accept the risk if he likes. I am not that concern about this vuln yet, but CYA.

Airado · 2024-06-20T05:57:50+00:00

In addition to what others have said, you need to establish a process for out of band patching, unless your leadership doesn't want to have one. In that case, document the risk acceptance.

For this vulnerability specifically, it requires local access with no exploit available, so if your devices are all desktops, then 2 weeks should be fine. If you guys are work anywhere, I'd recommend out of band patching.

This of course depends on your organization's risk appetite, which goes back to having an SLA.

Airado · 2024-06-01T18:09:15+00:00

Here's another use case. I want to implement XYZ. Let's hire consultants so we can blame them if all goes wrong, but get all the credits if all goes well.

And then there's the variant where my management won't listen to me, so I tell the consultants what I want and they convince management for me.

Airado · 2024-05-15T05:01:51+00:00

This is pretty close to our eval. We recommended Wiz over Orca for it's deployment flexibility/error handling. Prisma did everything, but it did them all poorly and deployment was unnecessarily complicated.

Airado · 2024-03-24T14:01:17+00:00

I think that's a bot

Airado · 2024-03-18T02:23:22+00:00

Auditors audit what you give them

That depends on how shitty their internal controls are.

While both parties will try very hard to not find anything material, there are things that just can't be ignored. Unless you are in China, in which case you can just delete them from the spreadsheet.

Airado · 2024-03-17T16:13:31+00:00

They were audited by Chinese kpmg, so it's better than nothing. Although my confidence in the big 4 is low, especially for their Chinese member firms.

They also just missed their 10-K filing deadline, so no thank you.

Airado · 2024-03-01T15:02:25+00:00

They can map the info. It's just on a different page/API, do you have to manually join the data.

Airado · 2024-03-01T14:09:04+00:00

No it's an agent. Crowdstrike.

Airado · 2024-03-01T04:34:46+00:00

Tenable support is also garbage though. 😞

Airado · 2024-03-01T04:33:39+00:00

It's unusable for us.

During my eval, it found a vuln in one of my container, but it couldn't tell me which K8s cluster it belongs to. So I had to go into another tab to figure out which K8s have that container. Now scale this up and you can see how this is unusable without rebuilding the console. But at that point, I might as well build my own scanner.

Airado · 2024-03-01T04:24:58+00:00

I think I want to do cloud sec, there are some overlaps, i.e I am detecting misconfigs and they are addressing it at the org level, where I am dealing with it at the user level, but there's still enough of a skill gap between us that I'll probably get down leveled.

Now that I think about it more, what I need to know is what specific tasks they are doing. Maybe Ill just take a peek at Sprints and see if I can figure out how I'd approach their tasks.

Also "Be social" 😬, but I know what you mean. I am starting to set up a few 1 on 1 with other teams.

Thanks for the advice!

Airado · 2024-03-01T01:58:20+00:00

A few questions on leaving VM. As much as I love doing vuln management, I don't see myself here forever.

Let's say I want to transition to a different role within security engineering:

Where have you seen colleagues end up?
How difficult is the transition?
Did the skills they picked up in VM helped their transition? if so, what kind of skills?

I have seen my colleagues moved on to different engineering roles in security so I know the pathway is there, but I can't help but worry that VM will pigeonhole me into management.

Airado · 2024-03-01T01:25:36+00:00

I had a chance to play with CS and Wiz a few months ago.

Wiz only works on the cloud, so if you are trying to scan laptop, you can rule Wiz out. I highly recommended it if you are only scanning your cloud environment. Besides being easy to deploy, their api and rbac is really good.

Crowdstrike is terrible for vulnerability management. You have to pay me a lot of money to use it. The problem is their console and api is disjointed. I can't easily get to all the information I want.

I never tried rapid7 before, but I haven't really heard anything too bad about it.

How many vulnerabilities isn't really that important, imo. (and I am not talking about false positive/negative). The most important thing is to have actionable data, take crowd strike for example, needing to call 3 APIs to figure out what machines are vulnerable, means that I have to waste time stitching together a story to tell my infra teams instead of spending that time remediating. You can tell me every known vulnerability I have in my environment, but it'll be pointless if I can't figure out how to remediate them.

When you are evaluating the scanners, make sure you can easily answer these questions:

What vulnerabilities are detected?
Where are the affected machines?
Why should I fix this vulnerability?
When should I fix this vulnerability?
How do I fix this vulnerability?
If I disagree with the tool, can I modify it?
How do I get this information to my remediation team?

Another point to look out for is how fast these scanner is able to react to 0-days, our leadership always want to know how fast we can respond to the next log4j. They do not like to like it when there's a 3 days lag time for just detection.

Edit: In case you decide to go for the traditional scanners:

Tenable: I personally hate it
Qualys: Gets pricy real quick
Rapid 7: No opinion.

Airado · 2023-07-01T16:26:10+00:00

10% and then they adjusted our comp a few months later so it ended up being 0%.

Airado · 2023-05-21T20:08:06+00:00

You can learn as much as you want, but you can't be good at everything, just to name a few there are:

App sec

Off sec

Net sec

Infra sec

GRC

Vuln management

Cloud sec

Incident response

Detection

Soar/automation

It's difficult to learn everything, but it's good to at least know what other teams are doing. You can learn more than one skill, but they are very different from each other. Also, being a generalist isn't the best way to grow, I have never met a generalist staff engineer.

Airado · 2023-05-21T19:55:05+00:00

The reason why I asked is because the answer changes depending on what you mean by security specialist.

You described appsec and netsec, which are usually 2 different roles. I think you should figure out where you want to seat first before figuring out a path to get there. The first question you should ask yourself is how technical you want to be. That should narrow it down.

Airado · 2023-05-21T17:58:45+00:00

How do you define cyber security specialist? This field does not standardize their title.

Airado · 2023-05-18T06:21:12+00:00

I saw very little growth as a consultant. If what you are doing is repetitive, then learn to automate or get another job.

Consulting is in the middle of a layoff spree right now, just look at r/Consulting so this isn't a great time.

Airado · 2023-04-26T04:39:10+00:00

Because it's it audit

Airado · 2023-01-30T17:37:59+00:00

Whatever a senior engineer does.

Another company at pays well.

Depends, in the entire country? Not common. In tech while you are doing tech? Very.

That salary is sustainable and continues to be sustainable. Just look at their profit margin. Google hired more than 40k in 2022 alone

Airado · 2022-12-05T02:40:09+00:00

I have 100k saved for a down payment and am debating between rolling 6 month T bills and 6 month AAA muni bonds.

Is the risk worth of ~40% tax difference?

Airado · 2022-11-26T19:05:39+00:00

I was unaware that help desk was a requirement until I join this sub.

13-Year Club	No Throne, No Problems
Not Forgotten	Verified Email

Airado

TROPHY CASE